From 43db73c5fb100b152fdb16cad274f0885bfbfee1 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 19 Jul 2012 13:52:56 -0700 Subject: [PATCH] 3.4-stable patches added patches: cifs-always-update-the-inode-cache-with-the-results-from-a-find_.patch cifs-on-config_highmem-machines-limit-the-rsize-wsize-to-the-kmap-space.patch ext4-fix-duplicated-mnt_drop_write-call-in-ext4_ioc_move_ext.patch hid-add-battery-quirk-for-apple-wireless-ansi.patch hid-add-sennheiser-btd500usb-device-support.patch hid-multitouch-add-support-for-baanto-touchscreen.patch md-avoid-crash-when-stopping-md-array-races-with-closing-other-open-fds.patch md-raid1-close-some-possible-races-on-write-errors-during-resync.patch mm-fix-lost-kswapd-wakeup-in-kswapd_stop.patch ntp-fix-sta_ins-del-clearing-bug.patch target-clean-up-returning-errors-in-pr-handling-code.patch target-fix-range-calculation-in-write-same-emulation-when-num-blocks-0.patch tcm_fc-fix-crash-seen-with-aborts-and-large-reads.patch --- ...-cache-with-the-results-from-a-find_.patch | 44 +++++ ...it-the-rsize-wsize-to-the-kmap-space.patch | 79 +++++++++ ...drop_write-call-in-ext4_ioc_move_ext.patch | 31 ++++ ...attery-quirk-for-apple-wireless-ansi.patch | 32 ++++ ...-sennheiser-btd500usb-device-support.patch | 44 +++++ ...h-add-support-for-baanto-touchscreen.patch | 55 ++++++ ...ay-races-with-closing-other-open-fds.patch | 161 ++++++++++++++++++ ...-races-on-write-errors-during-resync.patch | 55 ++++++ ...ix-lost-kswapd-wakeup-in-kswapd_stop.patch | 82 +++++++++ .../ntp-fix-sta_ins-del-clearing-bug.patch | 57 +++++++ queue-3.4/series | 13 ++ ...returning-errors-in-pr-handling-code.patch | 52 ++++++ ...ite-same-emulation-when-num-blocks-0.patch | 38 +++++ ...ash-seen-with-aborts-and-large-reads.patch | 37 ++++ 14 files changed, 780 insertions(+) create mode 100644 queue-3.4/cifs-always-update-the-inode-cache-with-the-results-from-a-find_.patch create mode 100644 queue-3.4/cifs-on-config_highmem-machines-limit-the-rsize-wsize-to-the-kmap-space.patch create mode 100644 queue-3.4/ext4-fix-duplicated-mnt_drop_write-call-in-ext4_ioc_move_ext.patch create mode 100644 queue-3.4/hid-add-battery-quirk-for-apple-wireless-ansi.patch create mode 100644 queue-3.4/hid-add-sennheiser-btd500usb-device-support.patch create mode 100644 queue-3.4/hid-multitouch-add-support-for-baanto-touchscreen.patch create mode 100644 queue-3.4/md-avoid-crash-when-stopping-md-array-races-with-closing-other-open-fds.patch create mode 100644 queue-3.4/md-raid1-close-some-possible-races-on-write-errors-during-resync.patch create mode 100644 queue-3.4/mm-fix-lost-kswapd-wakeup-in-kswapd_stop.patch create mode 100644 queue-3.4/ntp-fix-sta_ins-del-clearing-bug.patch create mode 100644 queue-3.4/series create mode 100644 queue-3.4/target-clean-up-returning-errors-in-pr-handling-code.patch create mode 100644 queue-3.4/target-fix-range-calculation-in-write-same-emulation-when-num-blocks-0.patch create mode 100644 queue-3.4/tcm_fc-fix-crash-seen-with-aborts-and-large-reads.patch diff --git a/queue-3.4/cifs-always-update-the-inode-cache-with-the-results-from-a-find_.patch b/queue-3.4/cifs-always-update-the-inode-cache-with-the-results-from-a-find_.patch new file mode 100644 index 00000000000..90da0b5cfcd --- /dev/null +++ b/queue-3.4/cifs-always-update-the-inode-cache-with-the-results-from-a-find_.patch @@ -0,0 +1,44 @@ +From cd60042cc1392e79410dc8de9e9c1abb38a29e57 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Fri, 6 Jul 2012 07:09:42 -0400 +Subject: cifs: always update the inode cache with the results from a FIND_* + +From: Jeff Layton + +commit cd60042cc1392e79410dc8de9e9c1abb38a29e57 upstream. + +When we get back a FIND_FIRST/NEXT result, we have some info about the +dentry that we use to instantiate a new inode. We were ignoring and +discarding that info when we had an existing dentry in the cache. + +Fix this by updating the inode in place when we find an existing dentry +and the uniqueid is the same. + +Reported-and-Tested-by: Andrew Bartlett +Reported-by: Bill Robertson +Reported-by: Dion Edwards +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/readdir.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -86,9 +86,12 @@ cifs_readdir_lookup(struct dentry *paren + + dentry = d_lookup(parent, name); + if (dentry) { +- /* FIXME: check for inode number changes? */ +- if (dentry->d_inode != NULL) ++ inode = dentry->d_inode; ++ /* update inode in place if i_ino didn't change */ ++ if (inode && CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) { ++ cifs_fattr_to_inode(inode, fattr); + return dentry; ++ } + d_drop(dentry); + dput(dentry); + } diff --git a/queue-3.4/cifs-on-config_highmem-machines-limit-the-rsize-wsize-to-the-kmap-space.patch b/queue-3.4/cifs-on-config_highmem-machines-limit-the-rsize-wsize-to-the-kmap-space.patch new file mode 100644 index 00000000000..59cbdc37d40 --- /dev/null +++ b/queue-3.4/cifs-on-config_highmem-machines-limit-the-rsize-wsize-to-the-kmap-space.patch @@ -0,0 +1,79 @@ +From 3ae629d98bd5ed77585a878566f04f310adbc591 Mon Sep 17 00:00:00 2001 +From: Jeff Layton +Date: Wed, 11 Jul 2012 09:09:35 -0400 +Subject: cifs: on CONFIG_HIGHMEM machines, limit the rsize/wsize to the kmap space + +From: Jeff Layton + +commit 3ae629d98bd5ed77585a878566f04f310adbc591 upstream. + +We currently rely on being able to kmap all of the pages in an async +read or write request. If you're on a machine that has CONFIG_HIGHMEM +set then that kmap space is limited, sometimes to as low as 512 slots. + +With 512 slots, we can only support up to a 2M r/wsize, and that's +assuming that we can get our greedy little hands on all of them. There +are other users however, so it's possible we'll end up stuck with a +size that large. + +Since we can't handle a rsize or wsize larger than that currently, cap +those options at the number of kmap slots we have. We could consider +capping it even lower, but we currently default to a max of 1M. Might as +well allow those luddites on 32 bit arches enough rope to hang +themselves. + +A more robust fix would be to teach the send and receive routines how +to contend with an array of pages so we don't need to marshal up a kvec +array at all. That's a fairly significant overhaul though, so we'll need +this limit in place until that's ready. + +Reported-by: Jian Li +Signed-off-by: Jeff Layton +Signed-off-by: Steve French +Signed-off-by: Greg Kroah-Hartman + +--- + fs/cifs/connect.c | 18 ++++++++++++++++++ + 1 file changed, 18 insertions(+) + +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -3348,6 +3348,18 @@ void cifs_setup_cifs_sb(struct smb_vol * + #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024) + #define CIFS_DEFAULT_NON_POSIX_WSIZE (65536) + ++/* ++ * On hosts with high memory, we can't currently support wsize/rsize that are ++ * larger than we can kmap at once. Cap the rsize/wsize at ++ * LAST_PKMAP * PAGE_SIZE. We'll never be able to fill a read or write request ++ * larger than that anyway. ++ */ ++#ifdef CONFIG_HIGHMEM ++#define CIFS_KMAP_SIZE_LIMIT (LAST_PKMAP * PAGE_CACHE_SIZE) ++#else /* CONFIG_HIGHMEM */ ++#define CIFS_KMAP_SIZE_LIMIT (1<<24) ++#endif /* CONFIG_HIGHMEM */ ++ + static unsigned int + cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info) + { +@@ -3378,6 +3390,9 @@ cifs_negotiate_wsize(struct cifs_tcon *t + wsize = min_t(unsigned int, wsize, + server->maxBuf - sizeof(WRITE_REQ) + 4); + ++ /* limit to the amount that we can kmap at once */ ++ wsize = min_t(unsigned int, wsize, CIFS_KMAP_SIZE_LIMIT); ++ + /* hard limit of CIFS_MAX_WSIZE */ + wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE); + +@@ -3419,6 +3434,9 @@ cifs_negotiate_rsize(struct cifs_tcon *t + if (!(server->capabilities & CAP_LARGE_READ_X)) + rsize = min_t(unsigned int, CIFSMaxBufSize, rsize); + ++ /* limit to the amount that we can kmap at once */ ++ rsize = min_t(unsigned int, rsize, CIFS_KMAP_SIZE_LIMIT); ++ + /* hard limit of CIFS_MAX_RSIZE */ + rsize = min_t(unsigned int, rsize, CIFS_MAX_RSIZE); + diff --git a/queue-3.4/ext4-fix-duplicated-mnt_drop_write-call-in-ext4_ioc_move_ext.patch b/queue-3.4/ext4-fix-duplicated-mnt_drop_write-call-in-ext4_ioc_move_ext.patch new file mode 100644 index 00000000000..b2b2714391d --- /dev/null +++ b/queue-3.4/ext4-fix-duplicated-mnt_drop_write-call-in-ext4_ioc_move_ext.patch @@ -0,0 +1,31 @@ +From 331ae4962b975246944ea039697a8f1cadce42bb Mon Sep 17 00:00:00 2001 +From: Al Viro +Date: Wed, 18 Jul 2012 09:31:36 +0100 +Subject: ext4: fix duplicated mnt_drop_write call in EXT4_IOC_MOVE_EXT + +From: Al Viro + +commit 331ae4962b975246944ea039697a8f1cadce42bb upstream. + +Caused, AFAICS, by mismerge in commit ff9cb1c4eead ("Merge branch +'for_linus' into for_linus_merged") + +Signed-off-by: Al Viro +Cc: Theodore Ts'o +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + fs/ext4/ioctl.c | 1 - + 1 file changed, 1 deletion(-) + +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -261,7 +261,6 @@ group_extend_out: + err = ext4_move_extents(filp, donor_filp, me.orig_start, + me.donor_start, me.len, &me.moved_len); + mnt_drop_write_file(filp); +- mnt_drop_write(filp->f_path.mnt); + + if (copy_to_user((struct move_extent __user *)arg, + &me, sizeof(me))) diff --git a/queue-3.4/hid-add-battery-quirk-for-apple-wireless-ansi.patch b/queue-3.4/hid-add-battery-quirk-for-apple-wireless-ansi.patch new file mode 100644 index 00000000000..4c40fb14eb5 --- /dev/null +++ b/queue-3.4/hid-add-battery-quirk-for-apple-wireless-ansi.patch @@ -0,0 +1,32 @@ +From 0c47935c5b5cd4916cf1c1ed4a2894807f7bcc3e Mon Sep 17 00:00:00 2001 +From: Daniel Nicoletti +Date: Wed, 4 Jul 2012 10:20:31 -0300 +Subject: HID: add battery quirk for Apple Wireless ANSI + +From: Daniel Nicoletti + +commit 0c47935c5b5cd4916cf1c1ed4a2894807f7bcc3e upstream. + +Add USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI, to the quirk list since it report +wrong feature type and wrong percentage range. + +Signed-off-by: Daniel Nicoletti +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-input.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -290,6 +290,9 @@ static const struct hid_device_id hid_ba + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, + USB_DEVICE_ID_APPLE_ALU_WIRELESS_2011_ANSI), + HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE }, ++ { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_APPLE, ++ USB_DEVICE_ID_APPLE_ALU_WIRELESS_ANSI), ++ HID_BATTERY_QUIRK_PERCENT | HID_BATTERY_QUIRK_FEATURE }, + {} + }; + diff --git a/queue-3.4/hid-add-sennheiser-btd500usb-device-support.patch b/queue-3.4/hid-add-sennheiser-btd500usb-device-support.patch new file mode 100644 index 00000000000..a3dd74d6b89 --- /dev/null +++ b/queue-3.4/hid-add-sennheiser-btd500usb-device-support.patch @@ -0,0 +1,44 @@ +From 0e050923a797c1fc46ccc1e5182fd3090f33a75d Mon Sep 17 00:00:00 2001 +From: Frank Kunz +Date: Thu, 5 Jul 2012 22:32:49 +0200 +Subject: HID: add Sennheiser BTD500USB device support + +From: Frank Kunz + +commit 0e050923a797c1fc46ccc1e5182fd3090f33a75d upstream. + +The Sennheiser BTD500USB composit device requires the +HID_QUIRK_NOGET flag to be set for working proper. Without the +flag the device crashes during hid intialization. + +Signed-off-by: Frank Kunz +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/usbhid/hid-quirks.c | 1 + + 2 files changed, 4 insertions(+) + +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -650,6 +650,9 @@ + #define USB_DEVICE_ID_SAMSUNG_IR_REMOTE 0x0001 + #define USB_DEVICE_ID_SAMSUNG_WIRELESS_KBD_MOUSE 0x0600 + ++#define USB_VENDOR_ID_SENNHEISER 0x1395 ++#define USB_DEVICE_ID_SENNHEISER_BTD500USB 0x002c ++ + #define USB_VENDOR_ID_SIGMA_MICRO 0x1c4f + #define USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD 0x0002 + +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -76,6 +76,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_PRODIGE, USB_DEVICE_ID_PRODIGE_CORDLESS, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_PIXART_IMAGING_INC_OPTICAL_TOUCH_SCREEN, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_OPTICAL_TOUCH_3008, HID_QUIRK_NOGET }, ++ { USB_VENDOR_ID_SENNHEISER, USB_DEVICE_ID_SENNHEISER_BTD500USB, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_SUN, USB_DEVICE_ID_RARITAN_KVM_DONGLE, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_1, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_SYMBOL, USB_DEVICE_ID_SYMBOL_SCANNER_2, HID_QUIRK_NOGET }, diff --git a/queue-3.4/hid-multitouch-add-support-for-baanto-touchscreen.patch b/queue-3.4/hid-multitouch-add-support-for-baanto-touchscreen.patch new file mode 100644 index 00000000000..5878b26c1d7 --- /dev/null +++ b/queue-3.4/hid-multitouch-add-support-for-baanto-touchscreen.patch @@ -0,0 +1,55 @@ +From 9ed326951806c424b42dcf2e1125e25a98fb13d1 Mon Sep 17 00:00:00 2001 +From: Jiri Kosina +Date: Fri, 20 Apr 2012 12:15:44 +0200 +Subject: HID: multitouch: Add support for Baanto touchscreen + +From: Jiri Kosina + +commit 9ed326951806c424b42dcf2e1125e25a98fb13d1 upstream. + +Reported-by: Tvrtko Ursulin +Tested-by: Tvrtko Ursulin +Signed-off-by: Jiri Kosina +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hid/hid-core.c | 1 + + drivers/hid/hid-ids.h | 3 +++ + drivers/hid/hid-multitouch.c | 4 ++++ + 3 files changed, 8 insertions(+) + +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1391,6 +1391,7 @@ static const struct hid_device_id hid_ha + { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUS_T91MT) }, + { HID_USB_DEVICE(USB_VENDOR_ID_ASUS, USB_DEVICE_ID_ASUSTEK_MULTITOUCH_YFO) }, + { HID_USB_DEVICE(USB_VENDOR_ID_BELKIN, USB_DEVICE_ID_FLIP_KVM) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_BAANTO, USB_DEVICE_ID_BAANTO_MT_190W2), }, + { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_BTC, USB_DEVICE_ID_BTC_EMPREX_REMOTE_2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CANDO, USB_DEVICE_ID_CANDO_PIXCIR_MULTI_TOUCH) }, +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -160,6 +160,9 @@ + #define USB_VENDOR_ID_AVERMEDIA 0x07ca + #define USB_DEVICE_ID_AVER_FM_MR800 0xb800 + ++#define USB_VENDOR_ID_BAANTO 0x2453 ++#define USB_DEVICE_ID_BAANTO_MT_190W2 0x0100 ++ + #define USB_VENDOR_ID_BELKIN 0x050d + #define USB_DEVICE_ID_FLIP_KVM 0x3201 + +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -783,6 +783,10 @@ static const struct hid_device_id mt_dev + HID_USB_DEVICE(USB_VENDOR_ID_ATMEL, + USB_DEVICE_ID_ATMEL_MXT_DIGITIZER) }, + ++ /* Baanto multitouch devices */ ++ { .driver_data = MT_CLS_DEFAULT, ++ HID_USB_DEVICE(USB_VENDOR_ID_BAANTO, ++ USB_DEVICE_ID_BAANTO_MT_190W2) }, + /* Cando panels */ + { .driver_data = MT_CLS_DUAL_INRANGE_CONTACTNUMBER, + HID_USB_DEVICE(USB_VENDOR_ID_CANDO, diff --git a/queue-3.4/md-avoid-crash-when-stopping-md-array-races-with-closing-other-open-fds.patch b/queue-3.4/md-avoid-crash-when-stopping-md-array-races-with-closing-other-open-fds.patch new file mode 100644 index 00000000000..2751e2f27b7 --- /dev/null +++ b/queue-3.4/md-avoid-crash-when-stopping-md-array-races-with-closing-other-open-fds.patch @@ -0,0 +1,161 @@ +From a05b7ea03d72f36edb0cec05e8893803335c61a0 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Thu, 19 Jul 2012 15:59:18 +1000 +Subject: md: avoid crash when stopping md array races with closing other open fds. + +From: NeilBrown + +commit a05b7ea03d72f36edb0cec05e8893803335c61a0 upstream. + +md will refuse to stop an array if any other fd (or mounted fs) is +using it. +When any fs is unmounted of when the last open fd is closed all +pending IO will be flushed (e.g. sync_blockdev call in __blkdev_put) +so there will be no pending IO to worry about when the array is +stopped. + +However in order to send the STOP_ARRAY ioctl to stop the array one +must first get and open fd on the block device. +If some fd is being used to write to the block device and it is closed +after mdadm open the block device, but before mdadm issues the +STOP_ARRAY ioctl, then there will be no last-close on the md device so +__blkdev_put will not call sync_blockdev. + +If this happens, then IO can still be in-flight while md tears down +the array and bad things can happen (use-after-free and subsequent +havoc). + +So in the case where do_md_stop is being called from an open file +descriptor, call sync_block after taking the mutex to ensure there +will be no new openers. + +This is needed when setting a read-write device to read-only too. + +Reported-by: majianpeng +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/md.c | 36 +++++++++++++++++++++++------------- + 1 file changed, 23 insertions(+), 13 deletions(-) + +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -3744,8 +3744,8 @@ array_state_show(struct mddev *mddev, ch + return sprintf(page, "%s\n", array_states[st]); + } + +-static int do_md_stop(struct mddev * mddev, int ro, int is_open); +-static int md_set_readonly(struct mddev * mddev, int is_open); ++static int do_md_stop(struct mddev * mddev, int ro, struct block_device *bdev); ++static int md_set_readonly(struct mddev * mddev, struct block_device *bdev); + static int do_md_run(struct mddev * mddev); + static int restart_array(struct mddev *mddev); + +@@ -3761,14 +3761,14 @@ array_state_store(struct mddev *mddev, c + /* stopping an active array */ + if (atomic_read(&mddev->openers) > 0) + return -EBUSY; +- err = do_md_stop(mddev, 0, 0); ++ err = do_md_stop(mddev, 0, NULL); + break; + case inactive: + /* stopping an active array */ + if (mddev->pers) { + if (atomic_read(&mddev->openers) > 0) + return -EBUSY; +- err = do_md_stop(mddev, 2, 0); ++ err = do_md_stop(mddev, 2, NULL); + } else + err = 0; /* already inactive */ + break; +@@ -3776,7 +3776,7 @@ array_state_store(struct mddev *mddev, c + break; /* not supported yet */ + case readonly: + if (mddev->pers) +- err = md_set_readonly(mddev, 0); ++ err = md_set_readonly(mddev, NULL); + else { + mddev->ro = 1; + set_disk_ro(mddev->gendisk, 1); +@@ -3786,7 +3786,7 @@ array_state_store(struct mddev *mddev, c + case read_auto: + if (mddev->pers) { + if (mddev->ro == 0) +- err = md_set_readonly(mddev, 0); ++ err = md_set_readonly(mddev, NULL); + else if (mddev->ro == 1) + err = restart_array(mddev); + if (err == 0) { +@@ -5124,15 +5124,17 @@ void md_stop(struct mddev *mddev) + } + EXPORT_SYMBOL_GPL(md_stop); + +-static int md_set_readonly(struct mddev *mddev, int is_open) ++static int md_set_readonly(struct mddev *mddev, struct block_device *bdev) + { + int err = 0; + mutex_lock(&mddev->open_mutex); +- if (atomic_read(&mddev->openers) > is_open) { ++ if (atomic_read(&mddev->openers) > !!bdev) { + printk("md: %s still in use.\n",mdname(mddev)); + err = -EBUSY; + goto out; + } ++ if (bdev) ++ sync_blockdev(bdev); + if (mddev->pers) { + __md_stop_writes(mddev); + +@@ -5154,18 +5156,26 @@ out: + * 0 - completely stop and dis-assemble array + * 2 - stop but do not disassemble array + */ +-static int do_md_stop(struct mddev * mddev, int mode, int is_open) ++static int do_md_stop(struct mddev * mddev, int mode, ++ struct block_device *bdev) + { + struct gendisk *disk = mddev->gendisk; + struct md_rdev *rdev; + + mutex_lock(&mddev->open_mutex); +- if (atomic_read(&mddev->openers) > is_open || ++ if (atomic_read(&mddev->openers) > !!bdev || + mddev->sysfs_active) { + printk("md: %s still in use.\n",mdname(mddev)); + mutex_unlock(&mddev->open_mutex); + return -EBUSY; + } ++ if (bdev) ++ /* It is possible IO was issued on some other ++ * open file which was closed before we took ->open_mutex. ++ * As that was not the last close __blkdev_put will not ++ * have called sync_blockdev, so we must. ++ */ ++ sync_blockdev(bdev); + + if (mddev->pers) { + if (mddev->ro) +@@ -5239,7 +5249,7 @@ static void autorun_array(struct mddev * + err = do_md_run(mddev); + if (err) { + printk(KERN_WARNING "md: do_md_run() returned %d\n", err); +- do_md_stop(mddev, 0, 0); ++ do_md_stop(mddev, 0, NULL); + } + } + +@@ -6237,11 +6247,11 @@ static int md_ioctl(struct block_device + goto done_unlock; + + case STOP_ARRAY: +- err = do_md_stop(mddev, 0, 1); ++ err = do_md_stop(mddev, 0, bdev); + goto done_unlock; + + case STOP_ARRAY_RO: +- err = md_set_readonly(mddev, 1); ++ err = md_set_readonly(mddev, bdev); + goto done_unlock; + + case BLKROSET: diff --git a/queue-3.4/md-raid1-close-some-possible-races-on-write-errors-during-resync.patch b/queue-3.4/md-raid1-close-some-possible-races-on-write-errors-during-resync.patch new file mode 100644 index 00000000000..955598b6386 --- /dev/null +++ b/queue-3.4/md-raid1-close-some-possible-races-on-write-errors-during-resync.patch @@ -0,0 +1,55 @@ +From 58e94ae18478c08229626daece2fc108a4a23261 Mon Sep 17 00:00:00 2001 +From: NeilBrown +Date: Thu, 19 Jul 2012 15:59:18 +1000 +Subject: md/raid1: close some possible races on write errors during resync + +From: NeilBrown + +commit 58e94ae18478c08229626daece2fc108a4a23261 upstream. + +commit 4367af556133723d0f443e14ca8170d9447317cb + md/raid1: clear bad-block record when write succeeds. + +Added a 'reschedule_retry' call possibility at the end of +end_sync_write, but didn't add matching code at the end of +sync_request_write. So if the writes complete very quickly, or +scheduling makes it seem that way, then we can miss rescheduling +the request and the resync could hang. + +Also commit 73d5c38a9536142e062c35997b044e89166e063b + md: avoid races when stopping resync. + +Fix a race condition in this same code in end_sync_write but didn't +make the change in sync_request_write. + +This patch updates sync_request_write to fix both of those. +Patch is suitable for 3.1 and later kernels. + +Reported-by: Alexander Lyakas +Original-version-by: Alexander Lyakas +Signed-off-by: NeilBrown +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/md/raid1.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1821,8 +1821,14 @@ static void sync_request_write(struct md + + if (atomic_dec_and_test(&r1_bio->remaining)) { + /* if we're here, all write(s) have completed, so clean up */ +- md_done_sync(mddev, r1_bio->sectors, 1); +- put_buf(r1_bio); ++ int s = r1_bio->sectors; ++ if (test_bit(R1BIO_MadeGood, &r1_bio->state) || ++ test_bit(R1BIO_WriteError, &r1_bio->state)) ++ reschedule_retry(r1_bio); ++ else { ++ put_buf(r1_bio); ++ md_done_sync(mddev, s, 1); ++ } + } + } + diff --git a/queue-3.4/mm-fix-lost-kswapd-wakeup-in-kswapd_stop.patch b/queue-3.4/mm-fix-lost-kswapd-wakeup-in-kswapd_stop.patch new file mode 100644 index 00000000000..ef0a9e5f40e --- /dev/null +++ b/queue-3.4/mm-fix-lost-kswapd-wakeup-in-kswapd_stop.patch @@ -0,0 +1,82 @@ +From 1c7e7f6c0703d03af6bcd5ccc11fc15d23e5ecbe Mon Sep 17 00:00:00 2001 +From: Aaditya Kumar +Date: Tue, 17 Jul 2012 15:48:07 -0700 +Subject: mm: fix lost kswapd wakeup in kswapd_stop() + +From: Aaditya Kumar + +commit 1c7e7f6c0703d03af6bcd5ccc11fc15d23e5ecbe upstream. + +Offlining memory may block forever, waiting for kswapd() to wake up +because kswapd() does not check the event kthread->should_stop before +sleeping. + +The proper pattern, from Documentation/memory-barriers.txt, is: + + --- waker --- + event_indicated = 1; + wake_up_process(event_daemon); + + --- sleeper --- + for (;;) { + set_current_state(TASK_UNINTERRUPTIBLE); + if (event_indicated) + break; + schedule(); + } + + set_current_state() may be wrapped by: + prepare_to_wait(); + +In the kswapd() case, event_indicated is kthread->should_stop. + + === offlining memory (waker) === + kswapd_stop() + kthread_stop() + kthread->should_stop = 1 + wake_up_process() + wait_for_completion() + + === kswapd_try_to_sleep (sleeper) === + kswapd_try_to_sleep() + prepare_to_wait() + . + . + schedule() + . + . + finish_wait() + +The schedule() needs to be protected by a test of kthread->should_stop, +which is wrapped by kthread_should_stop(). + +Reproducer: + Do heavy file I/O in background. + Do a memory offline/online in a tight loop + +Signed-off-by: Aaditya Kumar +Acked-by: KOSAKI Motohiro +Reviewed-by: Minchan Kim +Acked-by: Mel Gorman +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmscan.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -3013,7 +3013,10 @@ static void kswapd_try_to_sleep(pg_data_ + * them before going back to sleep. + */ + set_pgdat_percpu_threshold(pgdat, calculate_normal_threshold); +- schedule(); ++ ++ if (!kthread_should_stop()) ++ schedule(); ++ + set_pgdat_percpu_threshold(pgdat, calculate_pressure_threshold); + } else { + if (remaining) diff --git a/queue-3.4/ntp-fix-sta_ins-del-clearing-bug.patch b/queue-3.4/ntp-fix-sta_ins-del-clearing-bug.patch new file mode 100644 index 00000000000..6a6eebdebc4 --- /dev/null +++ b/queue-3.4/ntp-fix-sta_ins-del-clearing-bug.patch @@ -0,0 +1,57 @@ +From 6b1859dba01c7d512b72d77e3fd7da8354235189 Mon Sep 17 00:00:00 2001 +From: John Stultz +Date: Fri, 13 Jul 2012 01:21:50 -0400 +Subject: ntp: Fix STA_INS/DEL clearing bug + +From: John Stultz + +commit 6b1859dba01c7d512b72d77e3fd7da8354235189 upstream. + +In commit 6b43ae8a619d17c4935c3320d2ef9e92bdeed05d, I +introduced a bug that kept the STA_INS or STA_DEL bit +from being cleared from time_status via adjtimex() +without forcing STA_PLL first. + +Usually once the STA_INS is set, it isn't cleared +until the leap second is applied, so its unlikely this +affected anyone. However during testing I noticed it +took some effort to cancel a leap second once STA_INS +was set. + +Signed-off-by: John Stultz +Cc: Ingo Molnar +Cc: Peter Zijlstra +Cc: Richard Cochran +Cc: Prarit Bhargava +Link: http://lkml.kernel.org/r/1342156917-25092-2-git-send-email-john.stultz@linaro.org +Signed-off-by: Thomas Gleixner +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/time/ntp.c | 8 ++++++-- + 1 file changed, 6 insertions(+), 2 deletions(-) + +--- a/kernel/time/ntp.c ++++ b/kernel/time/ntp.c +@@ -409,7 +409,9 @@ int second_overflow(unsigned long secs) + time_state = TIME_DEL; + break; + case TIME_INS: +- if (secs % 86400 == 0) { ++ if (!(time_status & STA_INS)) ++ time_state = TIME_OK; ++ else if (secs % 86400 == 0) { + leap = -1; + time_state = TIME_OOP; + time_tai++; +@@ -418,7 +420,9 @@ int second_overflow(unsigned long secs) + } + break; + case TIME_DEL: +- if ((secs + 1) % 86400 == 0) { ++ if (!(time_status & STA_DEL)) ++ time_state = TIME_OK; ++ else if ((secs + 1) % 86400 == 0) { + leap = 1; + time_tai--; + time_state = TIME_WAIT; diff --git a/queue-3.4/series b/queue-3.4/series new file mode 100644 index 00000000000..a4f64941c1b --- /dev/null +++ b/queue-3.4/series @@ -0,0 +1,13 @@ +md-avoid-crash-when-stopping-md-array-races-with-closing-other-open-fds.patch +md-raid1-close-some-possible-races-on-write-errors-during-resync.patch +cifs-always-update-the-inode-cache-with-the-results-from-a-find_.patch +cifs-on-config_highmem-machines-limit-the-rsize-wsize-to-the-kmap-space.patch +target-clean-up-returning-errors-in-pr-handling-code.patch +target-fix-range-calculation-in-write-same-emulation-when-num-blocks-0.patch +ntp-fix-sta_ins-del-clearing-bug.patch +tcm_fc-fix-crash-seen-with-aborts-and-large-reads.patch +ext4-fix-duplicated-mnt_drop_write-call-in-ext4_ioc_move_ext.patch +mm-fix-lost-kswapd-wakeup-in-kswapd_stop.patch +hid-add-battery-quirk-for-apple-wireless-ansi.patch +hid-add-sennheiser-btd500usb-device-support.patch +hid-multitouch-add-support-for-baanto-touchscreen.patch diff --git a/queue-3.4/target-clean-up-returning-errors-in-pr-handling-code.patch b/queue-3.4/target-clean-up-returning-errors-in-pr-handling-code.patch new file mode 100644 index 00000000000..c09f1ccfb76 --- /dev/null +++ b/queue-3.4/target-clean-up-returning-errors-in-pr-handling-code.patch @@ -0,0 +1,52 @@ +From d35212f3ca3bf4fb49d15e37f530c9931e2d2183 Mon Sep 17 00:00:00 2001 +From: Roland Dreier +Date: Mon, 16 Jul 2012 15:17:10 -0700 +Subject: target: Clean up returning errors in PR handling code + +From: Roland Dreier + +commit d35212f3ca3bf4fb49d15e37f530c9931e2d2183 upstream. + + - instead of (PTR_ERR(file) < 0) just use IS_ERR(file) + - return -EINVAL instead of EINVAL + - all other error returns in target_scsi3_emulate_pr_out() use + "goto out" -- get rid of the one remaining straight "return." + +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_pr.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -2038,7 +2038,7 @@ static int __core_scsi3_write_aptpl_to_f + if (IS_ERR(file) || !file || !file->f_dentry) { + pr_err("filp_open(%s) for APTPL metadata" + " failed\n", path); +- return (PTR_ERR(file) < 0 ? PTR_ERR(file) : -ENOENT); ++ return IS_ERR(file) ? PTR_ERR(file) : -ENOENT; + } + + iov[0].iov_base = &buf[0]; +@@ -3826,7 +3826,7 @@ int target_scsi3_emulate_pr_out(struct s + " SPC-2 reservation is held, returning" + " RESERVATION_CONFLICT\n"); + cmd->scsi_sense_reason = TCM_RESERVATION_CONFLICT; +- ret = EINVAL; ++ ret = -EINVAL; + goto out; + } + +@@ -3836,7 +3836,8 @@ int target_scsi3_emulate_pr_out(struct s + */ + if (!cmd->se_sess) { + cmd->scsi_sense_reason = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; + } + + if (cmd->data_length < 24) { diff --git a/queue-3.4/target-fix-range-calculation-in-write-same-emulation-when-num-blocks-0.patch b/queue-3.4/target-fix-range-calculation-in-write-same-emulation-when-num-blocks-0.patch new file mode 100644 index 00000000000..6c8ce6796a5 --- /dev/null +++ b/queue-3.4/target-fix-range-calculation-in-write-same-emulation-when-num-blocks-0.patch @@ -0,0 +1,38 @@ +From 1765fe5edcb83f53fc67edeb559fcf4bc82c6460 Mon Sep 17 00:00:00 2001 +From: Roland Dreier +Date: Mon, 16 Jul 2012 17:10:17 -0700 +Subject: target: Fix range calculation in WRITE SAME emulation when num blocks == 0 + +From: Roland Dreier + +commit 1765fe5edcb83f53fc67edeb559fcf4bc82c6460 upstream. + +When NUMBER OF LOGICAL BLOCKS is 0, WRITE SAME is supposed to write +all the blocks from the specified LBA through the end of the device. +However, dev->transport->get_blocks(dev) (perhaps confusingly) returns +the last valid LBA rather than the number of blocks, so the correct +number of blocks to write starting with lba is + +dev->transport->get_blocks(dev) - lba + 1 + +(nab: Backport roland's for-3.6 patch to for-3.5) + +Signed-off-by: Roland Dreier +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/target_core_cdb.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/target/target_core_cdb.c ++++ b/drivers/target/target_core_cdb.c +@@ -1107,7 +1107,7 @@ int target_emulate_write_same(struct se_ + if (num_blocks != 0) + range = num_blocks; + else +- range = (dev->transport->get_blocks(dev) - lba); ++ range = (dev->transport->get_blocks(dev) - lba) + 1; + + pr_debug("WRITE_SAME UNMAP: LBA: %llu Range: %llu\n", + (unsigned long long)lba, (unsigned long long)range); diff --git a/queue-3.4/tcm_fc-fix-crash-seen-with-aborts-and-large-reads.patch b/queue-3.4/tcm_fc-fix-crash-seen-with-aborts-and-large-reads.patch new file mode 100644 index 00000000000..ec804afa7e7 --- /dev/null +++ b/queue-3.4/tcm_fc-fix-crash-seen-with-aborts-and-large-reads.patch @@ -0,0 +1,37 @@ +From 3cc5d2a6b9a2fd1bf024aa5e52dd22961eecaf13 Mon Sep 17 00:00:00 2001 +From: Mark Rustad +Date: Fri, 13 Jul 2012 18:18:04 -0700 +Subject: tcm_fc: Fix crash seen with aborts and large reads + +From: Mark Rustad + +commit 3cc5d2a6b9a2fd1bf024aa5e52dd22961eecaf13 upstream. + +This patch fixes a crash seen when large reads have their exchange +aborted by either timing out or being reset. Because the exchange +abort results in the seq pointer being set to NULL, because the +sequence is no longer valid, it must not be dereferenced. This +patch changes the function ft_get_task_tag to return ~0 if it is +unable to get the tag for this reason. Because the get_task_tag +interface provides no means of returning an error, this seems +like the best way to fix this issue at the moment. + +Signed-off-by: Mark Rustad +Signed-off-by: Nicholas Bellinger +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/target/tcm_fc/tfc_cmd.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/target/tcm_fc/tfc_cmd.c ++++ b/drivers/target/tcm_fc/tfc_cmd.c +@@ -240,6 +240,8 @@ u32 ft_get_task_tag(struct se_cmd *se_cm + { + struct ft_cmd *cmd = container_of(se_cmd, struct ft_cmd, se_cmd); + ++ if (cmd->aborted) ++ return ~0; + return fc_seq_exch(cmd->seq)->rxid; + } + -- 2.47.3